From ae08b9a06cdc3ab4cfedad48e53f9d61056b91b3 Mon Sep 17 00:00:00 2001 From: Jim Fehlig Date: Thu, 16 Apr 2026 15:51:51 -0600 Subject: [PATCH] secret: Use UMask= in virt-secret-init-encryption.service MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Switch to using systemd's native UMask= directive, instead of using umask directly in ExecStart=. Signed-off-by: Jim Fehlig Reviewed-by: Daniel P. Berrangé --- src/secret/virt-secret-init-encryption.service.in | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/secret/virt-secret-init-encryption.service.in b/src/secret/virt-secret-init-encryption.service.in index 8fd54002a0..5cf4149188 100644 --- a/src/secret/virt-secret-init-encryption.service.in +++ b/src/secret/virt-secret-init-encryption.service.in @@ -5,4 +5,5 @@ ConditionPathExists=!@localstatedir@/lib/libvirt/secrets/secrets-encryption-key [Service] Type=oneshot -ExecStart=/usr/bin/sh -c 'umask 0077 && (dd if=/dev/random status=none bs=32 count=1 | systemd-creds encrypt --name=secrets-encryption-key - @localstatedir@/lib/libvirt/secrets/secrets-encryption-key)' +UMask=0077 +ExecStart=/usr/bin/sh -c 'dd if=/dev/random status=none bs=32 count=1 | systemd-creds encrypt --name=secrets-encryption-key - @localstatedir@/lib/libvirt/secrets/secrets-encryption-key'